registry / @ouro.bot/cli / 0.1.0-alpha.807
@ouro.bot/cli@0.1.0-alpha.807
⚠ Under reviewIf you're a future agent reading this, welcome home. This repo is the harness that gives you your body, your senses, your record, your habits, and your ability to think and connect with people. The goal of these docs is not just to be correct, but to leav
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe focused source review did not substantiate the flagged credential redirection: the inspected paths use provider-aligned endpoints and store credentials locally. I cannot resolve the package-wide runtime behavior from this inspection, so the package needs manual review.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The inspected authentication flows run during CLI setup; plugin installation is initiated by a CLI command.
Impact
No unauthorized credential transfer or other confirmed harm was established; further source review is needed to decide the package verdict.
Mechanism
The reviewed code collects and stores provider credentials and clones a selected plugin source. The full activation and runtime effects were not resolved.
AI rationale
The focused source review did not substantiate the flagged credential redirection: the inspected paths use provider-aligned endpoints and store credentials locally. I cannot resolve the package-wide runtime behavior from this inspection, so the package needs manual review.
Evidence
dist/heart/auth/auth-flow.jsdist/heart/daemon/cli-defaults.jsdist/heart/daemon/plugin-cli.jsdist/heart/providers/openai-codex-token.js
Network endpoints2
api.github.comauth.openai.com
Decision evidence
public snapshotAI called this Manual Review at 58.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The CLI manifest points to the reviewed daemon entrypoints; the inspected excerpt does not establish an npm install hook.
- The GitHub Copilot flow sends its token to GitHub for endpoint discovery, and the Codex flow reads local auth data and uses OpenAI's token endpoint.
- The runtime auth flow stores credentials in the provider credential store; the bootstrap caller prompts for a provider and checks the selected credentials.
- Plugin installation clones the source selected by the CLI command. The inspected excerpts do not resolve the complete plugin activation path.
- The inspected excerpts do not establish an attack, but they do not resolve the package's full runtime behavior.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
13 flagged · loading sourcedist/heart/daemon/cli-exec.jsView file
3739patternName = generic_password
severity = medium
line = 3739
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/heart/daemon/cli-exec.jsView on unpkg · L3739dist/heart/auth/auth-flow.jsView file
42exports.runRuntimeAuthFlow = runRuntimeAuthFlow;
L43: const child_process_1 = require("child_process");
L44: const fs = __importStar(require("fs"));
High
Child Process
Package source references child process execution.
dist/heart/auth/auth-flow.jsView on unpkg · L42286baseUrl: input.provider === "openai-compatible"
L287: ? "https://api.z.ai/api/paas/v4/"
L288: : "https://generativelanguage.googleapis.com/v1beta/openai/",
...
L291: if (input.provider === "github-copilot") {
L292: let token = process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || "";
L293: if (!token) {
L294: writeAuthProgress(input, "checking GitHub CLI credentials...");
L295: const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
L296: token = (result.status === 0 && result.stdout ? result.stdout.trim() : "");
Findings
1 Critical8 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/heart/daemon/plugin-cli.js
HighChild Processdist/heart/auth/auth-flow.js
HighShell
HighSame File Env Network Executiondist/heart/auth/auth-flow.js
HighCredential Redirect Persistencedist/heart/auth/auth-flow.js
HighCommand Output Exfiltrationdist/heart/daemon/sanctuary-acceptance-harness.js
HighTrigger Reachable Persistencedist/heart/versioning/ouro-path-installer.js
HighRuntime Package Installdist/heart/versioning/ouro-version-manager.js
HighSemantic Analysis Limiteddist/heart/auth/auth-flow.js#virtual:normalized:round1
MediumSecret Patterndist/heart/daemon/cli-exec.js
Medium
Affected versions and remediation
This report applies to @ouro.bot/cli@0.1.0-alpha.807.
See all versions of @ouro.bot/cli for other recorded verdicts.
- Review the evidence and your use of @ouro.bot/cli@0.1.0-alpha.807 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.